EUVD-2026-83053
GHSA-qh37-vv9h-6h8f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description gates exploitation on physical/debug filesystem access (AV:P), yielding cleartext credential disclosure only, so C:H with I:N/A:N; no integrity or availability impact from a read-only storage flaw.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key.
AnalysisAI
Cleartext storage of wireless network credentials in CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 lets anyone who already holds the device's filesystem read the configured SSID and pre-shared key directly, with no cracking, decryption, or privilege escalation required once that access exists. Reaching the filesystem requires physical possession of the camera, use of an exposed on-board debugging interface, or chaining a separate vulnerability; it is not remotely reachable against a default network-facing configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the CM2507 camera's filesystem, obtained through one of three explicitly named paths: physical access to the device, use of an on-board debugging interface, or leveraging a separate/chained vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a HIGH-CVSS-but-LOW-real-risk case with a badly overstated vendor score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the available advisory data at time of analysis, so remediation must initially rely on compensating controls; check CISA ICSA-26-258-08 for a firmware update and apply it as soon as Carecam/HMT publishes one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 and verify they are physically secured; disable any exposed on-board debugging interfaces if supported. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmt Cm2507 Firmware
View allCM2507 IP cameras expose a privileged ONVIF management account that accepts an empty password, allowing anyone who can r
CareCam CM2507 IP cameras running firmware v251211.1507 store the root account password as a fixed, legacy hash that off
Physical-access arbitrary code execution on Carecam HMT.CM2507 IP cameras, where firmware automatically runs a predeterm
Unauthenticated access to the network video streaming service in CareCam CM2507 (HMT CM2507) IP cameras exposes live cam
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote de
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an un
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today